Loading story…
STAR Labs detailed a Linux kernel exploitation technique that uses prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) to spray anon_vma_name objects into GFP_KERNEL-backed kmalloc caches. The method targets systems with CONFIG_ANON_VMA_NAME enabled and was tested on Linux kernel 6.1.37, with controllable allocations spanning kmalloc-8 through kmalloc-96. Researchers said the object is attractive for exploitation because it has only a 4-byte header, can be allocated and freed directly from user space, and supports dynamically sized data up to an 80-byte name plus terminator.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
STAR Labs published a write-up describing a Linux kernel exploitation technique that uses prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME) to spray dynamically sized anon_vma_name objects into GFP_KERNEL-backed kmalloc caches. The article explains allocation, reuse and freeing behavior, and notes the technique was tested on Linux kernel 6.1.37 with potential memory disclosure via /proc/<pid>/maps.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat remediated **CVE-2022-42703**, a moderate-severity Linux kernel memory-management flaw in `mm/rmap.c` involving incorrect double reuse of a leaf `anon_vma` in `is_mergeable_anon_vma()`. An unprivileged local attacker could repeatedly invoke fork and memory operations to trigger a use-after-free and memory leak, causing a system crash. The issue affects kernels before version 5.19.7; upstream fixed it in commit `2555283eb40df89945557273121e9393ef9b542b`. Red Hat rated the flaw CVSS 3.1 **5.5**, with high availability impact and no assessed confidentiality or integrity impact. Fixes were issued for RHEL 7, 8, 8.6 Extended Update Support, 9, 9.0 Extended Update Support, and Red Hat Virtualization 4 on RHEL 8; Fedora incorporated the stable 5.19.7 kernel fix. RHSA-2023:3388 delivered the fix for RHEL 8.6 EUS alongside patches for three other kernel vulnerabilities. Organizations should install the applicable updated kernel packages and reboot affected systems; Red Hat identified no separate supported mitigation.
Aug 26, 2026
Security researchers and hardening vendors published a connected body of work showing how Linux kernel heap vulnerabilities can be turned into reliable exploitation primitives and how newer allocator-focused defenses aim to break those chains. Public research revisited `CVE-2021-26708`, including Alexander Popov's write-up on exploiting the bug and a later proof of concept demonstrating compromise through `sshd`, while additional analysis examined the `msg_msg` technique for kernel heap reconnaissance and the broader exploitation value of slab allocator behavior. Follow-on defensive work focused on disrupting those memory-unsafety paths at the allocator level. grsecurity described **AUTOSLAB** as a change to the kernel heap security model, HardenedVault assessed **SLUBStick** risk for embedded systems, and later discussed **VED** and post-`CFI` data-oriented protections intended to reduce exploit reliability even when control-flow defenses are present. Together, the reports show a shift from documenting practical Linux kernel heap exploitation to deploying mitigations that target heap grooming, object reuse, and data-only attack techniques.
Aug 17, 2026
Researchers at VUSec and Scuola Superiore Sant’Anna disclosed **Branch Target Reuse (BTR)**, a Spectre-v2-class attack that abuses stale indirect-branch predictor entries after JIT-generated code is freed and its cache region reused. The resulting speculative execute-after-free condition can redirect transient execution and expose secrets through cache side channels. Tests found the issue across evaluated Intel, AMD, and Arm CPUs and in JIT environments including Linux cBPF, Firefox SpiderMonkey, and Oracle GraalVM. Two end-to-end exploits against Linux’s cBPF JIT leaked arbitrary kernel memory on fully patched Intel systems with default mitigations enabled, recovering a root password hash within minutes at roughly 8 bytes per second. Linux has released and backported cBPF hardening tracked as `CVE-2026-64507` and `CVE-2026-64508`; mitigations use indirect branch prediction barriers on x86. GraalVM is randomizing JIT code-cache locations, while Mozilla is prioritizing Firefox site isolation after evaluating IBPB-based defenses. Researchers warned that existing hardware lacks a general mechanism to synchronize branch-prediction state with modified runtime code.
Oct 3, 2026